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REMARKS 

Applicants respectfully request reconsideration of this application, as amended. 

Applicants respectfully submit the objection to the claims is moot in view of the 
preliminary amendment filed contemporaneously with the application. 

Claim 1 recites, inter alia, a method for communicating to a server machine a 
certificate of a user sent by a client machine . . . comprising inserting said certificate into 
a cookie header of a request in the first protocol and transmitting the request, including 
the cookie header containing the certificate, from the security module to the server 
machine. 

In contradistinction, Devine is directed toward a secure customer interface for web 
based data management. Protocols provide an identification of the user, and then 
authentication of the user to insure the user is who he/she claims to be and a 
determination of entitlements that the user may avail themselves of in the enterprise 
system. With reference to Fig. 10 of Devine, and paragraphs 88-90 and 130-133, 
Applicants respectfully submit that Devine does not insert the certificate into a cookie 
header of a request in the first protocol as specified in Claim 1 . 

More particularly, and with reference to paragraph 90 of Devine, the exchange 
between the client and server is outlined with, once the server is authenticated, Devine 
teaching that it may be optionally possible to request a certificate from the client, if that is 
appropriate to the cipher selected. While Devine goes on to discuss the use of cookies, 
the cookies are discussed in relation to a preferred embodiment that associates a given 
https request with a logical session which is initiated and tracked by a "cookie jar server" 
32 to generate a "cookie" or session identifier which is a unique server-generated key that 
is sent to the client along with each reply to a https request. The client holds the cookie 
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session identifier and returns it to the server as part of each subsequent https request. As 
desired, either the web server 24, the cookie jar server 32, or the dispatch server 26, may 
maintain the "cookie jar" to map the session identifier to the associated session (see 
paragraph 66 of Devine). 

However, there is absolutely no teaching or suggestion of inserting a certificate 
into a cookie header of request, nor of the transmitting step, as recited in Claim 1. At 
least based on this distinction, Applicants respectfully submit that Claim 1 is patentably 
distinguishable from the Devine reference. The remaining claims are also patentably 
distinct from Devive at least based on the above and the additional feature(s) they recite. 

With all objections and rejections having been overcome, a Notice of Allowance 
is respectfully requested. 

Should the Examiner believe that any further action is necessary to place this 
application in better form for allowance, the Examiner is invited to contact Applicants' 
representative at the telephone number listed below. 
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The Commissioner is hereby authorized to charge to Deposit Account No. 
50-1 165 (T2 147-907679) any fees under 37 C.F.R. §§1.16 and 1.17 that may be required 
by this paper and to credit any overpayment to that Account. If any extension of time is 
required in connection with the filing of this paper and has not been separately requested, 
such extension is hereby requested. 



Respectfully submitted, 
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